Connecting a wallet to a dApp
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 5 min
In short
Connecting a wallet to a dApp does not, by itself, move anything. Assets move when you confirm a signature or an approval afterwards. Which is exactly why checking the domain you are connecting to, and actually reading the signing prompt, is the defence.
Key points
- Connecting grants read access to your address and balances; on its own it moves nothing
- The risk is in the signature or approval that follows — never confirm without reading it
- Check the domain in the address bar before connecting, and never arrive via a search advert
- Disconnect when you are done, and review your approvals periodically
Definition
Disclosing your wallet address to a decentralised application so that the site can ask you to sign transactions. Agreeing to connect and signing an individual transaction are two separate acts.
The flow is much the same across dApps. The site has a connect control; pressing it offers a choice of wallets; choosing one raises a prompt in the wallet; approving it hands your address to the site. Labels and placement differ, but the structure — site asks, wallet confirms, you decide — is universal. Grasp that and an unfamiliar site holds no surprises.
On a phone, the usual approach replaces the browser extension with a standard such as WalletConnect: the site shows a QR code and your wallet app scans it. There too, an approval screen appears in the app afterwards. Never scan a QR code someone sent you. Not letting anyone else choose your entry point matters.
Connecting moves nothing. What is handed over is an address, which the site uses to read balances and history. Note that addresses are public, so everything that address has ever done is visible to anyone. Connecting in the expectation of anonymity is a misunderstanding — this visibility is precisely why some people keep separate addresses for separate purposes.
The danger is in what comes next. dApps request signatures for various purposes: some merely prove who you are, some grant permission to move tokens (an approval), and some send assets outright. The wallet's confirmation screen shows the domain, the type of action, and the token and amount involved. Simply checking whether the amount is unlimited and whether you recognise the address being granted power avoids most of the damage people suffer.
Disconnecting when you are finished is good practice — but note that disconnecting does not undo approvals you already granted. Cleaning those up is a separate job; read 'Revoking token approvals' and make it a periodic habit.
Watch out for
- · If anything in the connection process asks for a seed phrase or private key, it is a scam, full stop. A legitimate dApp connection never involves entering either
- · Do not connect via social links, search adverts or airdrop announcements — look-alike domains impersonating real sites are everywhere
- · 'Your wallet needs to sync' and 'authentication error, please restore your wallet' are stock phrases used to steal seed phrases
Frequently asked questions
Can connecting alone drain my wallet?
Approving a connection does not by itself send anything; assets move only when you confirm a later signature or approval. That said, malicious sites typically request a hostile signature immediately after connecting, so in practice the defence is to sign nothing once you are connected.
Am I safe once I disconnect?
Disconnecting does not revoke approvals you already granted — those persist on the contract side and must be cancelled separately. Review your approval list periodically.